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APOLLO EXPERIENCE REPORT 

LUNAR MODULE ENVIRONMENTAL CONTROL SUBSYSTEM 

By Richard J. Gillen, James C. Brady, and Frank Collier 
Manned Spacecraft Center 

SUMMARY 


The experiences at the subsystem level of the lunar module environmental control 
subsystem are summarized to assist the operational development of a future similar 
subsystem. The subsystem concepts used were generally well established; however, 
the specific hardware designs were new. As a generalization, most problems were 
caused by some relatively common procedure that had not been performed to the proper 
quality level or to a requirement that, at that time, could not be defined in sufficient 
detail. 


INTRODUCTION 


The development of the lunar module (LM) environmental control subsystem (ECS) 
required some improvements in the state of the art and was successfully accomplished. 
In the interest of preserving history and of perhaps benefiting designers of future sys- 
tems, some of the development problems are recounted. It should be noted that many 
of the problems are of a subtle type that appear only after the hardware is used re- 
peatedly in many different ways. In many cases, the problems were resolved by chang- 
ing a procedure of use rather than by redesigning the item. This approach was used 
when it was felt that the unit was very sound and that the benefit of experience with a 
less-than-perfect unit would be better than rebuilding to get a new, untried, "perfect 1 1 1 
device with possibly new problems. The experience gained from use of the ECS is a 
very significant and positive asset. 


DESCRIPTION OF THE LUNAR MODULE ENVIRONMENTAL 
CONTROL SUBSYSTEM 

This section describes the lunar module ECS from a functional standpoint. The 
ECS configurations of the LM-3, LM-4, and LM-5 were all substantially the same with 
the following exceptions. 

1. The LM-3 vehicle was equipped with developmental flight instrumentation, and 

the ECS contained additional equipment- cooling provisions for this instrumentation. 



2. The LM-5 (Apollo 11) lunar landing vehicle and later vehicles included suit- 
liquid- cooling provisions to enhance the crewman- cooling capability. These provisions 
were substituted for the cabin heat- exchanger assembly. 

The complete schematic diagram of the LM-5 ECS is shown on prime contractor 
drawing LDW 330-55000, which can be obtained from the NASA Manned Spacecraft 
Center (MSC), Houston, Texas. This drawing shows part numbers and detailed fluid 
and electrical schematics. 

In summary, the LM-5 ECS was divided into the following functional sections. 

1. Atmosphere revitalization section (ARS) 

2. Oxygen (Og) supply and cabin pressurization section (OSCPS) 

3. Heat transport section (HTS) 

4. Water (HgO) management section (WMS) 


Atmosphere Revitalization Section 

The ARS (fig. 1) removes heat, moisture, odors, and carbon dioxide (COg) from 

the suit circuit of the two astronauts and provides the required atmosphere circulation. 
One of the two suit fans circulates the warm, moist, suit-circuit gases through the 
backup heat exchanger to the primary heat exchanger. The backup unit is a suit gas-to- 
water sublimator and is used only if the primary coolant circuit fails. The primary 
heat exchanger is a gas-to-coolant fluid (water /glycol) unit. The gas, which has been 
cooled below the dewpoint, enters the selected water-gas centrifugal separator. (An 
identical unit is provided for redundancy. ) These rotary devices are powered by the 
suit-circuit gas stream. The water is coalesced and thrown to the periphery where it 
enters a pitot tube, through which the water is delivered first to the WMS and then to 
the HTS for use in heat rejection. 

The suit gas may next be reheated, if required, by warm water/glycol in a re- 
generative heat exchanger activated by a manual valve. The regenerative heat ex- 
changer is functional only on the primary cooling circuit. Each crewman has a 
suit- isolation valve, which is normally open except during extravehicular operations. 
These fast-acting suit- isolation valves close automatically if the suit-circuit pressure 
becomes dangerously low. This safety feature functions if the space suit of one crew- 
member is torn or otherwise malfunctions while the cabin is depressurized. The crew- 
member with the good suit can then take corrective action. 

Flexible hoses deliver the conditioned gas to each astronaut and return the gas to 
the ECS for processing again. The gas is normally diverted to the pressurized cabin 
for circulation and is returned to the ARS through the cabin-gas return check valve. 

The gas next enters the primary replaceable filter cartridge that contains lithium hy- 
droxide (LiOH) to remove carbon dioxide and activated charcoal to remove odor. A 
secondary filter cartridge, which is identical to the cartridge used in the backpack or 
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Figure 1.- Atmosphere revitalization section simplified schematic. 
















portable life support system (PLSS), is normally used only when the primary cartridge 
is being changed. This cartridge change is preplanned to occur at a convenient time in 
the mission. A carbon dioxide sensing device is included in the ARS to assess the con- 
dition of the cartridges. Other items of instrumentation are provided to ensure optimum 
subsystem operation and safety. 

Supplemental cooling also is provided to the astronauts for periods of high meta- 
bolic heat rates by circulating cool water through plastic tubing, which is a part of the 
undergarments. The same undergarments provide cooling during extravehicular opera- 
tions. The liquid- cooling assembly uses a pump, an accumulator, and a temperature 
control valve to bypass the cooling water around the liquid- to- liquid heat exchanger. 


Oxygen Supply and Cabin Pressurization Section 


Gaseous oxygen is stored in the LM descent stage for use during the descent and 
lunar stay phases, and a small amount of gaseous oxygen is stored in the LM ascent 
stage for use during the lunar ascent phase and during rendezvous and docking with the 
command module. A simplified schematic of the OSCPS is shown in figure 2. The 
2800-psi descent oxygen supply is regulated 


to 900 psi by redundant regulators. Re- 
dundant bypass relief valves protect the 
descent oxygen tank against overpres- 
surization. Redundant low-rate over- 
board relief valves protect the section 
downstream of the regulators against ex- 
cessive pressure caused by a defective 
regulator or by flow through the bypass 
relief valves. A reseating burst disk 
provides high- rate relief for failed- open 
regulators. 

The descent oxygen supply and the 
redundant ascent oxygen supply are mani- 
folded through manual shutoff valves lo- 
cated in the cabin. The shutoff valves are 
mechanically interlocked to prevent the 
premature use of ascent oxygen. The 
900-psi descent oxygen is available for 
backpack recharge through appropriate 
valves and fittings. 


PLSS 



R denotes redundant component. 

Suit- circuit absolute pressure (and, 

therefore, cabin absolute pressure) is Figure 2. - Oxygen supply and cabin 

controlled by two manually selected, re- pressurization section simplified 

dundant regulators, both of which are schematic, 

normally activated. These automatic 
aneroid valves have electrical interlocks 

with the cabin repressurization valve to permit cabin depressurization when desired. 
The cabin repressurization valve can be manually or automatically actuated to restore 
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cabin pressure rapidly. A cabin relief and dump valve is provided on both LM hatches 
for automatic overpressure control and for controlled cabin depressurization. 

Heat Transport Section 

Heat from various sources is rejected by the sublimation of water (ice) to space 
vacuum. Two closed loops carry a circulating solution of 65-percent water and 
35-percent corrosion- inhibited ethylene glycol through heat exchangers and electronics 
cold plates and through the respective sublimators. Figure 3 is a simplified schematic 
of the HTS. The water/glycol is circu- 
lated at the nominal 2 50- lb/hr primary 
loop flow rate by one of two pumps. The 
suit heat exchanger and the low- 
temperature electronics cold plates are 
cooled in parallel. Next, the flow passes 
to the liquid- cooled- garment heat ex- 
changer and then to the high-temperature 
electronics cold rails. These cold plates 
and cold rails are carefully arranged in a 
series-parallel network with necessary 
flow control orificing to provide the proper 
thermal environment for each electronic 
unit. 

The primary sublimator rejects the 
collected heat, and the coolant absorbs the 
waste heat from the batteries before re- R denotes redundant component, 

turning to the filter and to the pump, at 

which point the circuit is complete. The Figure 3. - Heat transport section 

secondary coolant loop is substantially simplified schematic, 

the same, except that the primary guid- 
ance equipment is not cooled and only a 

single pump is provided. As previously noted, the suit loop is cooled by a backup 
sublimator and not by the secondary coolant circuit. 

Water Management Section 

The WMS is schematically illustrated in figure 4. The LM water is stored in one 
large descent tank (332-pound capacity) and two ascent tanks (42-pound capacity each). 
Each tank has a bladder pressurized with nitrogen (Ng) to expel the water in zero grav- 
ity and to force the water upward from the descent stage in one- sixth gravity during the 
lunar stay. Series -redundant water pressure regulators provide reduction of the pres- 
sure to a level compatible with sublimator requirements and permit suit-circuit 
condensate to be effectively pumped by the water separators. A backup set of series- 
redundant water pressure regulators is provided for secondary coolant-loop operation. 

The water used for PLSS refill, for drinking, for food preparation, and for fire 
extinguishing is tapped off through a dispenser located upstream of the pressure 
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Figure 4. - Water management section 
simplified schematic. 


regulators. Water and iodine are mixed 
at the time of LM water loading to give a 
low iodine concentration for bacteria 
control. 


TECHNICAL HISTORY 


The technical history is presented 
first for some general items that apply to 
the system as a whole or for items which 
cut across several subsystems. Next, the 
history of subsections is given for the HTS, 
the ARS, the OSCPS, and finally, the WMS. 
No attempt was made to arrange these by 
severity of the problem. All problems 
were significant at the time they were 
reported. 


General 

Interstage disconnects. - Interstage disconnects (LSC-330-505) are used between 
the ascent and descent stages to provide a flow path for high-pressure oxygen from the 
descent-stage oxygen tank to the environmental control subsystem in the ascent stage 
and to provide coolant flow paths for the descent- stage cold rails. Normally, service 
fluid lines between spacecraft stages are routed through cutter assemblies if the space- 
craft stages are required to separate during mission life. At the time of separation, 
the cutter assembly shears the lines (ensuring safe separation) and allows external 
leakage to occur at the sheared interfaces. Shearing of the glycol lines would have re- 
quired the installation of a shutoff valve (manual or electrical) in the supply to the 
descent stage and a check valve in the return line to prevent loss of glycol after separa- 
tion. Because of possible impact ignition, it was also considered unsafe to shear the 
oxygen line that contained 900-psia oxygen. The glycol coolant loop is serviced at the 
builder's plant; and, because normal ground checkout required separation of the ascent/ 
descent stages, it was more feasible to use disconnects to eliminate deservicing and 
reservicing of the coolant. Furthermore, the disconnects provide an automatic seal 
to prevent loss of fluid from either half of the disconnect after staging. 

The interstage disconnects were designed without retention mechanisms so they 
could be simply pulled apart. This method ensured minimum resistance to ascent/ 
descent-stage separation. Coupling of the ascent (structure mounted) disconnect half 
to the descent (structure mounted) disconnect half is maintained by squib bolts, which 
connect the two stages. 

The original design used a single compression seal and was successfully certified 
with flight bracket assemblies. From the beginning of vehicle assembly and checkout at 
the manufacturer' s plant, it was noted that this particular design was susceptible to 
damage during vehicle installation unless extreme care was taken. Subsequent installa- 
tion efforts at the NASA John F. Kennedy Space Center (KSC) verified the damage 
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susceptibility; and it was necessary to add a redundant seal (fig. 5) to the LM-3, LM-4, 
LM-5, and LM-6 coolant- loop disconnects to ensure no external leakage. The redun- 
dant seals were not used on the oxygen disconnects because the higher pressure 
(900 psia) provided a much better seal than the lower pressure (20 psia) glycol dis- 
connects. It was also found that the redundant-seal method used was ineffective at 
pressures above 50 psig. Starting with the LM-7 vehicle, a redesigned disconnect 
(fig. 6), which had built-in redundancy and also provided better protection to the sealing 
surfaces, was used. This design was certified by test and installed in the remaining 
vehicles. To date, this design has shown a high resistance to handling and installation 
damage. 




Figure 5. - Original design of interstage 
disconnect. 


Figure 6. - Final design of interstage 
disconnect. 


Battery configurat ion change . - The early LM vehicle design depended on fuel 
cells for electrical power generation. The reactants for the fuel cells (hydrogen and 
oxygen) were to be stored in the supercritical state, and it was planned to use the 
cryogens as a heat sink. 

After approximately 2 years of design work and studies, the power source was 
changed to batteries, the hydrogen was eliminated, and the oxygen storage method was 
changed to high-pressure gas. The ECS requirements and responsibilities were 
changed significantly at this time (approximately March 1965). High-pressure gaseous 
oxygen pressure regulators and relief valves were required, and the high-pressure 
oxygen storage tank in the descent stage became a new ECS responsibility. Previously, 
the ECS oxygen requirements had been supplied from the common cryogenic oxygen 
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descent-stage tank. While these changes were being considered and identified, a series 
of studies was performed to determine the new requirements for sizing water and 
oxygen consumables. Mission parameters were updated and varied to examine and to 
understand the vehicle and mission penalties associated with the changes. Implementa- 
tion of the changes produced a large impact upon the ECS. New designs were required 
for a large descent-stage gaseous oxygen tank (approximately 48-pound capacity at 
3000 psi) and two ascent-stage gaseous oxygen tanks (approximately 2.4-pound capacity 
each at 900 psi). New designs were required for the high-pressure gaseous oxygen 
pressure regulator and for the relief valves in the descent stage. Changes to the water 
tank designs were not required. In response to the late start, all of these changes were 
pursued vigorously to shorten the development cycle. 

In contrast to the large impact that the change to batteries had on the ECS, there 
was an early change to incorporate a redundant cooling loop. The redundant- loop 
change affected many hardware items but was implemented shortly after the subcon- 
tracts were initiated, and this change was easily accommodated. 

Reliability considerations . - Reliability analyses performed for each subsystem 
by the contractor resulted in Failure Mode and Effect Analyses and Single Failure Point 
Summary documents. During the course of the contract, these were periodically re- 
fined and improved in detail. The degree of detail was upgraded as more and more 
knowledge of the hardware was gained. These documents served the useful purpose of 
identifying for management those areas of subsystem design in which operational risks 
would be encountered and also identified the severity of the risk. For example, most 
equipment was adequately backed up by redundant components, and failure would result 
in nuisance-type situations rather than in hazardous conditions. These documents dealt 
with design and operations and were not of the probability assessment type. The cause- 
and-effect type of reliability approach was found by management to be more useful than 
dealing strictly with abstract numbers of mean time to failure. 

The reliability program also included shelf- life control. Problems were en- 
countered in implementing effective shelf-life control. The original plan by which this 
program was established failed to set up strict controls, such as periodic checking of 
the stored equipment. Based upon observations of shelf- life control, it is felt that 
future programs should implement strict controls early in the program by providing 
for periodic testing or periodic operation of equipment, by applying a conscious con- 
sideration of shelf life when evaluating each engineering change (after configuration 
control is established), and by requiring that positive actions are established for all 
hardware when the shelf- life limitation is reached. 

The failure reporting portion of the reliability program also had some significant 
aspects. Every out-of-specification condition was formally documented from the time 
manufacturing of a component was completed. Thus, development problems and in- 
process checks and calibrations were not reported, but all acceptance test (and sub- 
sequent) problems were reported. A report was accepted and closed only when a 
comprehensive analysis of the cause was documented and corrective action was ini- 
tiated. The prevailing philosophy of ’’every failure has a cause” required a compre- 
hensive investigation into the failure causes. Accurate reporting proved helpful many 
times in referring back to a problem. All failure reports were reviewed by top man- 
agement at the Flight Readiness Review and required closure or a satisfactory explana- 
tion to remove constraints to flight release. A failure report "explanation” meant that, 
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although the failure was not completely closed, there was a satisfactory explanation 
for a specific spacecraft as a result of extra testing, isolation of the problem to a spe- 
cific lot, and so forth. 

Flight instrumentation . - The operational instrumentation installed in the ECS 
provided minimum information concerning performance. The vehicle penalties for 
instrumentation were significant, and only data that were considered to be vital were 
provided. The instrumentation requirements were established early and included a 
number of valve position indicators. These valve position indicators were switches that 
caused a closed or open circuit to stimulate a telemetry signal, depending upon the 
position of a valve handle. In retrospect, these data have not proven very useful; and 
the weight, power, and volume penalties could have been better allocated to instrumen- 
tation for subsystem performance. The valve position indicators are perhaps useful 
where an inadvertent electrical actuation is possible; but, for manually selected valve 
positions, they are redundant to a voice link for verification of proper subsystem 
configuration. 

Very small plunger travel was used to actuate the switches, and this made pre- 
cision alinement necessary. The switch design was also found to be susceptible to 
change in performance (actuation force) with a change in ambient pressure. Many 
switches were found to have defective internal springs, which changed their 
performance. 

These switches were also difficult to install properly in some valve designs. In 
one application (suit- isolation valves), more than a half dozen indirect measurements 
(with cumulative tolerances) were required for the switch installation because, as a 
result of inaccessibility, there was no simple, direct way to measure the installation 
shimming required. 

Several switch applications were deleted from the system where operational ex- 
perience indicated that the function provided could not justify retention of the device. 

In other cases, a change was made to increase the overtravel, giving more positive 
switch action. 

Modular concepts . - Modular packaging concepts were used in several places 
where certain groupings of equipment appeared desirable. Some of the advantages and 
drawbacks experienced are discussed. 

The major package in the LM ECS was the suit-circuit assembly (LSC-330-190 
package), which contained the necessary atmosphere processing equipment — such as 
valves, heat exchangers, carbon dioxide removal elements, suit fans, and instrumen- 
tation — for the suit circuit. Interfaces with the electrical power system, with telem- 
etry signals, with the water system, with the coolant system, with the cabin gas, with 
the suit gas umbilical hoses, and with the oxygen supply were required. A summary of 
components and interfaces for the ECS packages is given in table I. 

The suit-circuit assembly was densely packaged to accommodate the required 
hardware in the allotted space. Use of the modular concept was necessary because of 
the weight and volume constraints, but this led to a number of problems throughout the 
program. Whenever equipment was modified or changed, the certification testing 
program was modified accordingly. " Delta' * qualification rims, which caused the same 
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TABLE I. - COMPONENT MAKEUP OF LM ECS ASSEMBLIES 



Environmental control subsystem package, LSC-330- 



Component 

190 

192 

290 

390 

392 

490 

Total 

Suit- circuit 
assembly 

Suit 

coolant 

assembly 

Coolant 

recirculation 

assembly 

Oxygen 

control 

module 

High-pressure 

oxygen 

control 

assembly 

Water 

control 

module 

Heat exchanger 

3 

1 





4 

Water separator 

2 






2 

Fan and motor 

2 

1 





3 

Valve 

9 

1 

6 

5 

5 

9 

35 

Pressure regulator 




2 

2 

3 

7 

LiOH canister 

2 






2 

LiOH cartridge 

2 






2 

Transducer and switch 

10 


2 

4 

! 


16 

Fluid interface 
connection 

19 

4 

4 

7 

3 

12 

49 

Pump and motor 


1 

3 




4 

Accumulator 


1 





1 

Flow control orifice 

1 

2 

j 




3 

Voltage regulator 


1 





1 

Filter 



1 

4 



5 

Total per assembly 

50 

12 

16 

22 

10 

I 24 

134 


basic package to be subjected to a number of different qualification test runs, were 
required in many instances to qualify the revised equipment. The interdependence of 
packaging and functional effects was adequately demonstrated by tests, but a great num- 
ber of tests and a considerable amount of time were required. 

It had been planned to replace the entire package in the field if any component 
required change for any reason. Changing an entire package was a fairly lengthy proc- 
ess, and a large number of tests were required to verify that all the components within 
the replacement package were functioning properly after installation. For this reason, 
the practice of changing individual components with the package installed, wherever 
possible, was adopted. This practice, which was successfully performed on a number 
of occasions, saved much time in the vehicle cabin and thus generally avoided schedule 
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slips. Because of the dense packaging, however, removal and replacement of compo- 
nents within an installed package was a difficult task. On each occasion, practice rims 
were made on a bench package at the subcontractor’s plant to establish a suitable pro- 
cedure (to ensure that no damage would be done) and to train the person who was to 
make the change. The exact procedure to be followed in the flight vehicle was developed 
and, in a sense, ’’qualified” before authorization was given to proceed with replacing 
the flight item. These procedures included the necessary reverification tests. 

Dense packaging caused practical problems that required the expenditure of extra 
time and effort as the penalty for minimizing cabin volume usage. It is not reasonable 
to assume that complex packages can be installed and never require a component 
change; therefore, it appears that the trade between time and packaging convenience 
must always be carefully weighed and understood. Packaging was less complex for 
other areas. (Coolant pumps, filters, and valves were designated as the LSC-330-290 
package; the cabin oxygen control module, consisting of valves and pressure regulators, 
was called the LSC-330-390 package; water system valves and regulators were desig- 
nated the LSC- 330-490 package; the high-pressure oxygen control module with pressure 
regulators and relief valves was designated the LSC- 330- 392 package; and the liquid- 
cooling provisions for the crewmen were designated the LSC-330-192 package. ) 

Pump packaging was quite successful with no particular complications. The oxy- 
gen and water module packages used complex castings, into which the necessary active 
elements were fitted. Integral manifolding and the lack of numerous tubes and fittings 
are the main features of the casting approach. This concept worked quite well for the 
oxygen modules. However, for the water system module, a number of design changes 
were necessary; and the inflexible configuration caused by the casting concept led to 
add-on valves, capped bosses, and similar modifications to achieve minimum- impact 
changes. For the water system module, the use of a casting proved to be an encum- 
brance because the casting design became fixed before the design requirements became 
firm. However, this problem was not experienced with the oxygen modules, and the 
screw-in components were very easily replaced and retested. 


Heat Transport Section 

Water/glycol f ormulation . - The coolant fluid caused several problems even though 
the application was considered to be well within the state of the art. Initially, the fluid, 
which was formulated to give the following mixture, was specified to be the same as 
that for the command and service module. 


Material 

Ethylene glycol 

Distilled water 

Triethanolamine phosphate 

Sodium mercaptobenzothiazole (NaMBT) 


Part s by weight 

62.5 

As necessary to make 100 parts 
1 . 6 
0.9 
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By using an identical fluid in both spacecraft, the problems of logistics and of 
ground- support equipment could be minimized. 

During the development of the heat transport components, it was found that addi- 
tional specific heat capacity was required, which necessitated revising the formulation 
to one containing more water and less ethylene glycol. This change improved the spe- 
cific heat from 0. 72 to 0. 86 Btu/lb°F. 

This change also increased the freezing point from approximately -65° to -2° F, 
but the antifreeze protection was not needed in the LM ECS because the coldest tem- 
peratures encountered are from sublimation of cooling water (in ice form) to space 
vacuum. The modified LM water/glycol formulation was as follows. 


Material 

Parts by weight 

Ethylene glycol 

35.0 

Distilled water 

As necessary to make 100 parts 

Triethanolamine phosphate 

1. 6 

Sodium mercaptobenzothiazole 

0.9 


With the change to the modified coolant, which was made in August 1965, it was 
necessary to adjust the pH of the mixture to a higher value in order to keep the corro- 
sion inhibitors in solution. The appropriate pH was determined experimentally by the 
spacecraft prime contractor. 

The new coolant was successfully used until June 1969, shortly before the 
Apollo 11 flight, when a precipitate problem was encountered on the LM-5 vehicle. 
During routine fluid sampling for cleanliness and fluid property maintenance, a large 
number of precipitate crystals were found to be present. A number of fluid exchanges 
were made, and special filtering was performed; but the crystals rapidly reformed 
again. In the intensive investigations into the problem, it was found that a relatively 
minor change in a corrosion inhibitor had been made a few months before. A higher 
purity mercaptobenzothiazole (MBT) was introduced instead of the previously used 
commercial grade chemical. The commercial grade fluid produced a hazy solution 
during preparation, which required approximately a week to let the haze form and then 
required filtering to remove it. This slow manufacturing cycle was improved by using 
the higher purity chemical. During the investigation into the crystal problem, it was 
determined that the commercial inhibitor contained a small amount of sodium sulfite as 
a stabilizer. Sodium sulfite was added to the LM-5 fluid, but the crystal formation 
still persisted even after repeated flushes with the modified-purified fluid. The amount 
of sodium sulfite involved was 2 percent (weight) of the NaMBT, which makes up 
0. 9 percent (weight) of the finished water/glycol. Thus, a stabilizing agent in the 
amount of 0. 018 percent had been omitted. As discovered on the LM-5 vehicle, this 
quantity would not, of itself, inhibit or dissolve the crystals. The crystals were identi- 
fied as the disulfide decomposition product of the NaMBT. Because there was no in- 
dication of any damage to the tubing or other system components caused by corrosion, 
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the main problem seemed to be whether the particles would degrade system flow rates, 
clog the system filter or system orifices, or abrade the pump. Bench testing was con- 
ducted with two different pump-filter packages for endurance; and, although the filter 
plugged both times and the automatic relief valve bypassed the filter, the pumps per- 
formed normally. The pumps were dismantled and showed no unusual wear. The 
crystals were observed to be rather fragile in character and apparently were readily 
passed through the pumps. No clogging of the flow- balancing orifices occurred during 
bench tests. Gross precipitate was formed in the laboratory, and the fragile nature of 
the precipitate allowed it to pass through the finest orifices used with only a minute 
pressure head. Based on all these tests, the LM-5 vehicle was flown with the crystals 
present, and no problems were encountered. 

Subsequent vehicles were drained, flushed thoroughly with water and with isopro- 
pyl alcohol, then refilled with water/glycol formulated with the previously used com- 
mercial grade inhibitor. This fluid has again proved more stable and is a satisfactory 
coolant. The investigations showed clearly that subtle amounts of unknown "impurities” 
other than sodium sulfite in the commercial product have a crystal- inhibiting and 
crystal- dissolving action. A contract (NAS 9-9956) was let to continue the investigation 
into determining the nature of these impurities and also to investigate what system ef- 
fects (flow rates, etc. ) may cause disulfide crystals to form. 

Sublimator develop ments . - The development of the sublimators for heat-load 
rejection caused probably the most significant design problems of the LM ECS. The 
relative simplicity of sublimator operation might give a misleading impression of the 
difficulties involved in the design and manufacture of the device. Simplicity is apparent 
in the cutaway view (fig. 7) and in the expanded section shown in figure 8. The early 
problems were difficulty in brazing the porous plates and in achieving a good bond with- 
out plugging the pores with braze material, 
techniques. The early units were also 
showing performance degradation rates 
(with usage time) that were not encourag- 
ing; and, also, the initial performance 
was below expectations. Loss of porosity 
of the plates directly reduces perform- 
ance, and this seemed to be the problem. 

Porous plates with higher permea- 
bility were used; and several other im- 
provements in fabrication were tried, 
including welding of fins to the porous 
plates to eliminate brazing problems. 

Performance improvements were made by 
increasing the density of heat-transfer 
fins in the coolant passages. Additionally, 
to meet performance requirements, it was 
required to control the installation of po- 
rous plates so that the finer pore orienta- 
tion was always facing the steam vent sublimator. 

passage . 


Materials were changed as were brazing 


Water in 


Evaporant 

(water 

passage) 


Cold 

glycol out 



Steam out 


Figure 7. - Cutaway view of water 
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Chlorine was added to the stored 
water to act as a biocide. The chlorinated 
water produced unacceptable performance 
in the sublimators. Formation of a 
chlorine-based residue on the steam- 
passage side of the porous plates caused a 
depression of the freezing point, and water 
breakthrough occurred. Testing was per- 
formed by using iodine as the biocide, and 
these tests showed that iodine was 
acceptable. 


Performance degradation history was 
taken from measured data on a Saturn sub- 
limator used for instrument unit electronics 
cooling. Degradation was found to occur as 
a result of the slow accumulation of corro- 
sion products during storage. Degradation 
during operation was found to be related to 
the cumulative water quantity boiled per 
square foot of surface, and this was caused 
by corrosion and by the slow blockage of 
pores with particulate matter. 

To guarantee specified performance 
at the time of a mission, a higher perform- 
ance is required at the time of acceptance 
testing. The magnitude of this performance margin was established by tests and anal- 
yses. The most sensitive parameters were the duration of operation and the quantity of 
water used per square foot of sublimation surface. The sublimator plates and assem- 
blies were stored in a dry nitrogen environment to minimize degradation for as much of 
the manufacturing and checkout process as possible. 

Flight experience with the sublimators has been very satisfactory on LM flights 
to date. Performance has been very stable and has followed preflight predictions. 

Quick disconnects . - Quick disconnects were used in the heat transport section for 
convenience in making and breaking several connections. Several problems that were 
caused by loss of the lubricant within the connectors occurred. 

Whenever a draining operation was required, isopropyl alcohol was used following 
draining to flush the residual water/glycol from the system. Removal of the lubricant 
by the alcohol prevented free action of the moving parts and thereby caused incomplete 
sealing. Leakage resulted when these units were subjected to gaseous leakage checks, 
although it was felt that the liquid coolant would not leak because of the lubricity prop- 
erties of the liquid. However, in practice, any unit showing gaseous leakage was re- 
moved and replaced to guarantee a leak-free system. To prevent replacement time, 
the ground- support equipment interface quick disconnects were redesigned to allow 
reapplication of lubricant following alcohol exposure. 


IflAA/fl 
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Figure 8. - Expanded section of water 
sublimator. 


14 



It was also found that the plasticizer in Buna-N elastomers used in the quick dis- 
connects was shrunk by the isopropyl alcohol after a certain period of alcohol exposure 
as determined by testing. The alcohol flush times were controlled to values less than 
the critical exposure times. 

Accumulat or designs . - A water/glycol accumulator that would maintain acceptable 
leakage at the flanges proved difficult to build. An accumulator unit is illustrated in 
cutaway view in figure 9. The diaphragm forms the sealing gasket, and slight irregu- 
larities in the molded diaphragm result in 
uneven and inadequate sealing forces. The 
size of the flange groove was reduced to 
achieve the proper bead squeeze. The 
metal shoulder on the flange had to be re- 
designed to control the amount of dia- 
phragm squeeze. The use of higher 
torquing of the screws on the retaining 
ring around the flange was also imple- 
mented. The screws had to be added be- 
cause high torquing of the retaining ring • 
itself created relative displacement of the 
top and bottom shells, which tended to 
wrinkle the diaphragm. After the screws 
were added, leakage problems seemed to 
be well in hand. 


Approximately a year later, a large 
crack was discovered at the angle section 
of a retaining ring. Investigation into this 
problem revealed that the material (alu- 
minum alloy 2024T4) was subjected to 
stresses above those allowed for stress- 
corrosion control. All accumulators 
were recalled, the ring material was changed to aluminum alloy 7075T7351, and the 
cross section was thickened in the affected area to reduce stress levels. 

It is important to note that the stress-corrosion problem was brought on by the 
solution of a totally unrelated problem. Higher and higher stresses were imposed on 
the unit by incrementally increasing the squeeze on the diaphragm bead for sealing 
purposes. Problems with stress corrosion were common in a number of subsystems 
in the LM. In this case, the material in all of the glycol accumulator retaining rings 
was greatly overstressed; however, only one unit failed. It appears that stress corro- 
sion may or may not occur even when the stresses are well above the "threshold” 
values. However, the uncertainty associated with stress corrosion is such that ad- 
herence to threshold stress levels is the only safe approach. 

Sublimator breakthro ugh problems . - The initial redundant cooling loop contained 
no water/glycol accumulator. An "accumulator effect" was designed into the system 
by an interface with the water system. This design required that the secondary coolant 
loop be maintained at a subatmospheric pressure to accommodate expected thermal 
expansions and contractions and to provide a pressure compatible with the water sys- 
tem in case the secondary cooling system were activated. 



Detail A 


Steel ring 



Fluid 

port 


Figure 9. - Coolant accumulator (item 
LSC-330-210). 
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Figure 10 illustrates the general arrangement of the redundant cooling system 
and the water system. The interface of these two systems is at the puncture disk, and 
activation of the secondary cooling loop included puncturing of this disk so that the water 
system could serve as an accumulator. The use of ganged valves ensured that the 
selection of the proper water valves drove a pointed plunger through the puncture disk. 
Because this was an irreversible step that left the systems with some intermixed fluid 
and required special cleaning, the actuating mechanism was arranged to prevent in- 
advertent puncturing of the disk. Despite this design and the use of warning flags dur- 
ing ground operations, there were several instances early in the program when the 
disk was punctured during factory operations. 



Overboard 


Overboard 


Overboard 


Figure 10. - Simplified diagram of original design of redundant cooling 

loop/water system. 


This configuration was sensitive to the absolute pressure in the water/glycol 
loop. A high pressure caused water/glycol to enter the waterline feeding the secondary 
sublimators. Development testing indicated that the sublimators had an acceptable 
tolerance to the ethylene glycol (commonly used as "permanent" antifreeze). The 
pressure in the secondary water/glycol system was established by filling it with hot, 
deaerated water/glycol and then sealing it off. When the system cooled to ambient 
temperatures, it was at a subatmospheric pressure (approximately 5 psia). 

Thermal- vacuum testing on a lunar module test article (LTA-8) provided the 
first opportunity for testing with complete spacecraft systems. A very slight leak 
existed, and the pressure that was locked off in the secondary coolant loop slowly rose. 
During the "hot case" secondary loop operation, the disk was punctured and the sec- 
ondary sublimators failed. The glycol had caused sufficient lowering of the freezing 
point of the sublimator feedwater to prevent an ice layer from forming, allowing the 
water to break through and to freeze in the steam duct. To eliminate this interface 
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between the water system and the secondary water/glycol loop, the design was changed 
by adding an accumulator. The puncture disk and waterline were removed, and plugs 
and caps were installed to isolate the systems. 

Pump noise . - The coolant pumps, which are located in the cabin, have produced 
high noise levels. Surveys have shown that the pumps are not noisy in themselves, but 
the vanes produce pulses of fluid flow which excite the coolant lines and (sometimes) the 
cabin structural panels to which the tubes are attached. The coolant is carefully deaer- 
ated to prevent the formation of gas bubbles, which could cause cavitation or flow block- 
age. This removal of gas lowers the bulk modulus, which aggravates the noise 
problem. Several methods of quieting the pumping noise were investigated and evalu- 
ated. An expansion device that produced a significant reduction in noise was included 
downstream of the pump on later vehicles. 

The noise experienced on missions was somewhat distracting, both because of the 
intensity and because of an apparent change in frequency on occasion. This frequency 
changing has not been completely understood, but it is felt that reducing the overall 
noise level will make any such occurrences less noticeable. 

The pulsing of flow can be detected by slight, periodic pressure changes of ap- 
proximately 10 psi. The mechanical stresses caused by these pulses within the system 
components were determined to be insignificant. Because these fluctuations at 
400 hertz produced ’’noisy” data, the pump discharge pressure transducer was elec- 
trically damped. The pressure ripple at 400 hertz results from the 6000 rpm of the 
four-vaned pump. 


Atmosphere Revitalization Section 

Liqui d- cool e d- garment provisions . - A crew complaint in December 1968 indi- 
cated thatT the LM-4 suit cooling was marginal during the altitude- chamber rim at KSC. 
Design and checkout data reviews showed that the LM-4 suit cooling portion of the ECS 
was performing somewhat better than specification, and the suits themselves were 
found to be within specification. Several methods of providing cooling performance 
improvements were investigated to see if the gas cooling could be extended. The design 
cooling capacity is 520 Btu/man-hour for steady -state operation. It was concluded that 
only minor improvements could be realized with the gas cooling approach. A system 
design change was made quickly to provide chilled water from the LM for circulation 
through the liquid-cooled garments. This method of cooling provides a large increment 
of cooling capacity. Even with the worst-case (warm water) situation, a 1200- Btu/man- 
hour metabolic load can be comfortably handled; and 2 000- Btu/man-hour loads can be 
accommodated for at least short periods, although heavier perspiration is experienced. 

The design that was adopted for liquid cooling was not optimized; instead, maxi- 
mum usage was made of existing components to make the unit available for LM-5, the 
first lunar landing vehicle (Apollo 11). The cabin heat exchanger was removed not only 
to provide a location for the new unit (designated the LSC-330-192 package) in the 
cabin, but also because the cabin temperature control range provided by the cabin heat 
exchanger was a rather small value. This follows the trend of both Gemini spacecraft 
and the Apollo command module ECS experience, in which the cabin temperature con- 
trol provisions have been quite small compared to the capacity of suit-circuit heat 
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exchangers. Typically, after the design has proceeded as far as vehicle thermal- 
vacuum testing and flight, there has been enough confidence to delete or to deactivate 
the cabin heat exchangers. The design selected also removed the cabin temperature 
control valve and one cabin fan. The remaining cabin fan was retained for contingency 
purposes to enable cabin atmosphere mixing and purging necessitated by the loss of 
carbon dioxide removal capability. The liquid-to- liquid heat exchanger that was as- 
sociated with the cabin heat exchanger was relocated and replumbed to chill the water 
with cold water/glycol. As a sidelight to the deletion of the cabin heat exchanger, the 
cabin temperature sensor was no longer located in any gas stream and thus sensed a 
temperature in a remote corner of the cabin. It had been observed that a waterline 
temperature closely approximated the cabin temperature (because the water is routed 
through the cabin, giving a considerable dwell time); therefore, the water temperature 
was used as cabin temperature by flight controllers. This procedure saved relocating 
the sensor to a location which would receive good airflow of representative cabin- gas 
temperature. 

The water pump used in the LSC-330-192 unit is a PLSS design and uses 16 volts 
dc. A voltage regulator was designed to drop the LM 28-volt dc power to the correct 
voltage. This voltage regulator was the only new item designed for the LSC-330-192 
package. A glycol valve was modified to bypass the circulating water around the 
liquid-to- liquid heat exchanger for crew comfort. This design provides water at the 
same temperature for both crewmen; and, if one is overchilled, he can disconnect the 
water umbilical at the suit. A schematic diagram of this unit is shown in figure 11. 



Coolant from Coolant to 

low-temperature high-temperature 

electronics cold rails 


Figure 11.- Schematic diagram of the LSC-330-192 package. 









Water separators. - The water separators underwent several changes to achieve 
specified performance. Considerable early development testing was performed to re- 
duce the gas-side pressure drop and still achieve water pumping capability. Later, the 
assembly was redesigned to improve the pitot tube (water pump) efficiency, the bearing 
supports, and the assembly method. In later stages of development, several of the gas 
inlet vanes were blocked to give the gas stream impinging on the turbine blades of the 
rotating drum a higher velocity. In addition, the blade angle was changed, and the 
water pitot probe was again modified. Wire mesh was added to the drum to assist the 
coalescing of the droplets. A cutaway view of the flight configuration is shown in 
figure 121 


All the development changes were 
aimed at improving the pumping capabil- 
ity with low gas-flow rates. During qual- 
ification testing, the unit experienced a 
failure to start following a shutdown. In 
this condition, the ullage water that is 
retained within the unit settles to the 
bottom and creates a high resistance to 
rotation when restart is attempted with a 
low gas-flow rate at minimum system 
pressure. Clearances were revised, 
drain provisions were added, and addi- 
tional inlet guide vanes were blocked. 

This design was then qualified by test for 
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Figure 12.- Centrifugal water separator 
(item LSC- 330- 109). 
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During the flight of Apollo 11, 
waterdrops were sprayed onto the crew- 
men on several occasions. The subsequent investigations identified several possible 
reasons, but the cause was finally determined to be water separator overspeed. The 
gas-flow was considerably in excess of specification as a result of better-than- 
specifieation performance of the suit fans 
and because of lower-than-nominal system- 
pressure drops. At high speeds, the water 
in the trough splashes; and some is car- 
ried downstream and into the suits. A 
simple orifice plate was added to the pri- 
mary lithium hydroxide cartridge to re- 
turn the gas-pressure drop to specification 
value in order to provide necessary water 
removal efficiency. Because the secondary 
lithium hydroxide cartridge is smaller 
than the primary cartridge and produces 
a pressure drop compatible with proper 
water separator performance, this snap- 
in item, which is illustrated in figure 13, 
was not required for the secondary 
cartridge. 
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Figure 



Spacer rings Outer 
Lithium hydroxide screen 
Teflon felt filter 



13. - Primary LiOH cartridge 
(item LSC-330- 122). 
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Suit- isolation val ves. - During the safety reassessments following the Apollo 
spacecraft fire in 1967, a completely new valve was developed and provided for isolation 
of the suit gas umbilical hoses. The change provided electrically actuated, fast-acting 
valves that automatically closed both supply and return hoses of both crewmen if suit- 
circuit pressure dropped below a safe level. Use of the valve guaranteed that at least 
one crewman would be protected (pressurized) and enabled to reopen his hoses manu- 
ally, to close the hatch (which was presumably open in order to get a low cabin pressure 
in the first place), and to repressurize the cabin. The previous design was manually 
actuated only and provided protection for one less failure than the solenoid actuated 
design. This change was made rather late in the program and proceeded without major 
problems. Sluggish operation on several units required a minor change of materials 
to retain clearances after repeated usage. 


A cutaway view of this valve is shown 
in figure 14. The cabin repressurization 
valve could be automatically actuated by 
means of the switch shown on the cutaway 
only if the repressurization valve was in 
the automatic mode. This switch was later 
removed as an unnecessary function. 

Actuation of the suit- isolation valves 
was initially achieved by a suit-pressure 
transducer, which activated relays through 
signals from the caution and warning sub- 
system. This design was changed to acti- 
vate the relays directly from a snap-acting 
pressure switch. This change improved 
the reliability and simplified the overall 
design. Originally, the transducer signal 
was compared with a preset voltage level 
in the caution and warning subsystem, 
which triggered the relay that applied the 
voltage to the isolation valves when the 
suit-circuit pressure decreased below the 
present level. 



for "disconnect" mode 


Figure 14. - Suit- isolation valve 
(item LSC-330-138). 


Carbon dioxide sensor . - A number of 
problems were encountered with the carbon 
dixoide sensor used in the LM ECS, and the unit was frequently criticized. Despite the 
criticisms, the flight performance was generally good and provided useful data. The 
functional schematic diagram of the carbon dioxide sensor is shown in figure 15. 


This instrument was initially Government-furnished equipment and was later 
turned over to the contractor to be supplied as contractor-furnished equipment. When 
the unit was retested to prove compatibility with the LM vibration levels, vibration 
problems were encountered. Other sensitivities were detected in the course of further 
ground testing, and design changes made are discussed in the following paragraphs. 


The unit was mounted on vibration isolators to help attenuate the vibration envi- 
ronment. In addition, a more rugged infrared (IR) source (lamp) was used; and the unit 
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case was ruggedized. The unit was de- 
signed to have a dc ground; but, because 
this was incompatible with the LM caution 
and warning system, an ac ground 
(resistance- capacitance network) was 
added to delete electromagnetic interfer- 
ence (EMI) sensitivity. 

If water entered the unit, it could 
bridge a narrow gap and set up a galvanic 
corrosion cell, which would then degrade 
the optical filter layers and seriously de- 
grade the sensitivity of the unit. An epoxy - 
type coating was added to cover the metal 
surface near the filter and thus eliminate 
the galvanic cell action. 


Figure 15. - Simplified system diagram 
of a COg sensor. 


Calibration changes with time and 
temperature were traced to outgassing of 
the conformal coating in the electronics 
section. Because the outgas products 
absorbed IR energy at the same wavelength 
(4. 3 microns) that carbon dioxide does, elimination of the resultant distorted signals 
required a change to the conformal coating material. In addition, a trim resistor and a 
thermistor were added to the circuitry for temperature compensation. 


Flight performance indicated satisfactory operation except for several momentary 
excursions during engine firings and several instances when water is believed to have 
been introduced into the sensor. Solids or liquids which interrupt the optical signal 
appear as large amounts of carbon dioxide and distort the signal. The unit will return 
to normal operation after the water dries. 


Lithium hydroxide . - Cartridges containing lithium hydroxide are located in the 
suit- circuit assembly to provide chemical control of carbon dioxide. During the pro- 
gram, several significant design changes were made. 

The early design allowed the granular lithium hydroxide to abrade when the unit 
was subjected to vibration, and "dust" that was generated and evolved with the effluent 
gas was very caustic and irritating to eyes, nose, and throat tissues. The design was 
changed in early 1966 by compressing the granules tighter within the container so that 
relative motion was inhibited. The packing procedure was also changed to load only a 
fraction of the cartridge, then vibrate lightly to pack the granules, load some more, 
vibrate, and so forth until the unit was properly filled. Figure 13 shows the flight con- 
figuration in cutaway view. 

Polyurethane foam was the material that was used to compress the granules. 

This material, which was selected to give uniformly high loading, was durable even 
under required storage vacuum and temperature conditions. Following the Apollo 
spacecraft fire in January 1967, the use of polyurethane foam for compressing lithium 
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hydroxide granules was prohibited. Although fire testing of this design was success- 
fully passed, the presence of the polyurethane foam represented an immeasurable 
hazard, which was judged to be undesirable. 

The ensuing redesign considered other "foam rubber" materials of the fireproof 
class (Fluorel foams) along with metallic springs and washers to achieve the chemical 
bed compression loading. Because the fireproof foams were not too well developed at 
that time, the metallic spring design was adopted and qualified for use. The filter 
material contained in the cartridge was changed from Dacron to Teflon felt at the same 
time. 


During the Apollo 10 (LM-4) flight, an unusually high rate of carbon dioxide in- 
crease, followed by a decrease, was noted. (See the section entitled "Flight Experi- 
ence. ") The LM-4 LiOH cartridge, which was returned in the Apollo command module 
for analysis by the manufacturer, became the first item of LM equipment to be re- 
turned for postflight analysis. Following chemical and X-ray diffraction analyses, it 
was finally concluded that variations in the 
chemical conversion rates combined with 
carbon dioxide sensor tolerances accounted 
for the flight performance variations. No 
evidence of channeling or breakthrough 
was found, and no design changes were 
deemed necessary. Figure 16 shows the 
flight data combined with test data from 
ground-test cartridges. It can be seen 
that performance variations that reflect 
widely varying rates of increase had been 
experienced. Subsequent flight perform- 
ance predictions were made for optimistic 
and pessimistic variations to account for 
the dispersions seen in test. The peaks 
seen at 6 and 7. 7 hours were typical of 
closed suit-loop operation and were caused 
by a combination of reduced suit-loop mass 
flow and an increase in carbon dioxide 
partial pressure. Future designs should 
attempt to maintain system pressure and 
flow during suited and unsuited operations. 

Suit-circuit f ans. - The suit fan 
motors were initially manufactured by a 
vendor to the main subcontractor. Prob- 
lems were experienced both in failures 
of the power transistors and in consistently getting the correct rotational direction as 
a result of improper phasing of the integral inverters. This development was eventually 
taken over by the main subcontractor, and design changes were established to correct 
the problems. 

Bearing problems were caused by (1) contamination, which required improved 
cleaning; (2) inadequate lubrication, which necessitated changing from G-300 to 
Andok-C grease; and (3) bearing race brinelling, which required an improved fixture 



Figure 16.- Lithium hydroxide cartridge 
performance curves. 
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to pull bearings. Particulate contamination during the manufacturing operation was 
corrected by revised techniques and by design changes. The fan wheel rubbed during 
early testing, and clearances were changed slightly. Shimming was used to prevent the 
inducing of loads into the fan scroll from the ductwork. 


Fan discharge duct 


In late 1968, an EMI suppression filter within a suit fan electronics package was 
found to have an intermittent open circuit during KSC checkout. The problem was 
traced to overheating of the EMI filters 
when heavy electric leads were soldered 
on. The overheating caused failure of a 
solder joint within a capacitor. The 
change to heavy-gage wire was made as 
a result of wiring safety reviews following 
the spacecraft 204 accident at KSC in 1967. 

The configuration of the radial flow fan- 
motor assembly is shown in figure 17 and 
a motor cutaway view in figure 18. De- 
tails of the EMI filter configuration and 
wiring arrangement are shown in figure 19. 


Direct current 
brushless motor 


It was desired to test the units in 
place within the vehicle to save time. A 
bench test program was set up in an effort 
to determine whether the capacitor lead 
would be intermittently open, but the tests 
were unsuccessful. The tests used X-ray, 
rf energy, and an ”rf sniffer." The 
X-ray approach was unsuccessful because 
the problem joint was too inaccessible in 
the installation. Imposing rf energy on 
the power leads proved to be only partially 
successful because it would not consist- 
ently generate enough rapid local heating 
to cause a capacitor open circuit. These 
bench tests were tried on units which had 
been intentionally failed as well as on 
some good units. The rf sniffer, which 
would detect radiated electromagnetic 
noise, could not consistently detect a prob- 
lem in intentionally failed units because of 
poor accessibility of the probe. 

The design solution for the filter 
problem was to move the heavy-wire con- 
nection point farther from the capacitor 
lead and to install a wiring lug that was 
better suited to the heavy wire. A method 
was developed to remove the suit fans 
(two per vehicle) from the vehicle instal- 
lation and to replace them with redesigned 



Gas flow 


Figure 17.- Suit fan- motor assembly. 



Figure 18. - Cutaway view of suit fan 
motor. 
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Figure 19. - Suit fan EMI filter 
configuration. 



Note: Valve shown in "auto" position. 

Figure 20. - Cabin repressurization and 
emergency oxygen valve. 


units. This procedure proved to be suc- 
cessful when done by one specific, metic- 
ulous assembly technician. The potentially 
faulty fans were replaced on the LM-3 
(Apollo 9) vehicle at KSC, thus saving 
many days of replacement and checkout 
time that would have been required for 
replacement of a complete ARS package. 
The highly skilled technician was presented 
a " Snoopy” award for his effort. The 
exact method and the technique required to 
perform these replacements were practiced 
and perfected at the subcontractor* s plant 
before they were performed on the flight 
vehicle. 

Oxygen Supply and Cabin Pressurization 
Section 

Cabin repressur ization and emer- 
gency oxygen valve . - The cabin repres- 
surization and emergency oxygen valve is 
used to repressurize the cabin and can be 
actuated manually or automatically by a 
solenoid in response to low cabin pressure. 
During design feasibility testing, the 
manual-close seat was found to be sus- 
ceptible to permanent setting, and the seat 
material was changed from Viton B to 
Viton VB90. The configuration is illus- 
trated in figure 20 and is designated con- 
figuration A (fig. 21(a)). 

During production acceptance testing 
prior to the endurance phase of qualifica- 
tion, leakage again occurred in the manual- 
close mode. Inspection revealed that the 
seat had cracked as a result of compres- 
sive loads. The seat was redesigned to a 
wave-type shape (configuration B, fig. 21(b)) 
to allow required compression with lateral 
material expansion. This configuration 
was subjected to verification tests followed 
by formal certification tests. During the 
vibration- temperature testing of the certi- 
fication program, the valve again leaked 
in the manual-close mode. It was deter- 
mined that tolerance buildup was allowing 
the valve poppet to load unevenly and to 
move laterally during vibration. A design 
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change was made to the seat length to provide better centering and to resist lateral 
movement. Certification testing was completed with no additional leakage problems. 
Configuration C (fig. 21(c)) is the final seat and seal design. 



(a) Configuration A. 


(b) Configuration B. 


i 


} 



(c) Configuration C. 


Figure 21. - Seat and seal details — 
cabin repressurization and 
emergency oxygen valve. 


The cabin repressurization and 
emergency oxygen valve, a high flow- rate 
device, is located in the cabin immediately 
behind the lunar module pilot. When the 
valve position is changed from "close" to 
"auto" or from "auto" to "close," a 
sharp, loud report occurs. This "bang" 
is caused by high-pressure gas expanding 
to produce a shock wave. Testing of the 
valve demonstrated adequately that no 
equipment damage is incurred; but the 
noise has been startling to the crew, par- 
ticularly when their helmets are off. 
Several design modifications were consid- 
ered, but no changes were directed. The 
very satisfactory functioning of the existing 
design was felt to be a distinct asset and 
the flight crew recommended retaining 
the design and providing proper alerting 


of the crews. This has become an expected 
noise during activation/deactivation of the LM subsystems and during extravehicular 
activity (EVA) preparations. 


Demand regulators . - The oxygen demand regulator (LSC-330-306) is one of two 
parallel- redundant units that are used to provide suit- loop and cabin pressure control. 
The regulator (fig. 22) is basically a balanced rocker/poppet design with calibrated 
springs working against an aneroid bellows for absolute pressure control. A failed- 
open regulator is overridden by the closure of a redundant manual seat. The aneroid 
chamber is isolated from the regulated pressure chamber, and each chamber is con- 
nected to the suit loop by a separate line. 
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Figure 22. - Cutaway view of oxygen demand regulator. 


The original design was highly sensitive to vibration while the demand regulator 
was operating within its pressure- control regions. Various aneroids and mass- 
balancing techniques were employed before the design was acceptable. The final de- 
sign did not completely eliminate the increased leakage during vibration, but the 
suit- loop oxygen volumes are such that negligible pressure rise would occur during 
the vibration periods. 

On several occasions, the oxygen demand regulators were contaminated by water, 
which produced corrosion following system checkout problems at the factory. These 
problems, which were always associated with testing the suit circuit ’’wet” by using 
the metabolic simulator (which introduces steam into the ECS), were identified only 
after some length of time following the incidents. In some cases, excessive water has 
been introduced as a result of metabolic simulator problems or by test errors with 
other related ground-test equipment that blocked the water discharge from the separa- 
tors. The result was that water collects at the low point in the system where the oxygen 
regulator discharge tube attaches to the suit circuit. Testing is performed at 5 psia; 
and, at the completion of testing, water is driven upward into the demand regulators 
when the pressure is returned to sea level. Subsequent drying operations (evacuation 
and purge) were ineffective in removing the water from the regulators; and corrosion 
resulted, particularly on the aneroid bellows. The relationship between the water 
separator area of the suit circuit and the oxygen demand regulators is shown in fig- 
ure 23. The use of steam in the metabolic simulator was finally discontinued during 
all factory operations to avoid moisture problems. 
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High-pressure 



Figure 23. - Elevation schematic of 
demand regulator/suit circuit. 


Cabin dump and rel ief valve . - Two 
(redundant) cabin dump and relief valves 
(LSC-330-307) are used in each LM vehicle. 
Each valve provides cabin pressure relief 
at 5. 6 + 0. 2 psid and is sized to prevent 
overpressurization of the cabin from any 
single failure of high-pressure oxygen 
lines or components. Manual actuations 
are provided to allow depressurization of 
the cabin when desired and also to close 
off the main poppet if the servo control 
fails open. A section view of the valve 
is shown in figure 24. The cabin dump 
and relief valve has three modes of opera- 
tion, as follows. 

1. The ’’dump" mode mechanically 
lifts the main poppet, allowing manually 
controlled cabin depressurization. 


External 



Figure 24. - Cabin dump and relief valve 
(item LSC-330-307). 


2. The "auto" mode allows the 
servo valve (which is referenced to cabin 
and external environments) to control 
pressure by equalizing the servo chamber 
pressure with external pressure, allowing 
cabin pressure to force the main poppet 
open. Once the servo valve reseat pres- 
sure is reached, the servo valve closes; 
and the servo chamber is returned to 
cabin pressure by pressure inbleed through 
the cabin reference orifice that causes the 
main poppet to close. 

3. The "close” mode is provided to 
allow manual closure of the main poppet if 
the servo fails open. Overboard leakage 
for this failure is limited to 1 lb/hr by 
the cabin reference orifice. 


During initial certification testing of 
the cabin dump and relief valve, the leak- 
age rates were out of specification following vibration-temperature exposure. Tear- 
down indicated that a material used as a volume filler in the servo chamber was 
cracking and generating particle contamination that lodged in the servo valve seat, pre- 
venting full closure of the servo valve. The filler material, which was necessary dur- 
ing development tests to achieve the proper dynamic responses of the valve, was 
changed from an expanded molded foam (like styrofoam) to gaskets formed from a 
silicone rubber compound. Certification was completed with no additional design 
changes. 
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High-pressure regulation and relief. - The high-pressure oxygen control module 
(designated LSC-330-392) in the descent stage used a combination of three modes of 
pressure relief. Redundant bypass relief valves provided low-rate relief to the section 
downstream of the pressure regulators. Redundant low- rate overboard relief valves 
provided pressure relief, if necessary, during translunar coast. The low-rate over- 
board relief valves were set to operate at a pressure higher than the pressure at which 
the bypass relief valves operate. A reseating burst disk provided high-rate relief at 
the highest relief pressure. By design, none of these relief valves should ever be re- 
quired to function during a mission. 

One of the most significant features of this module was the incorporation of the 
reseating burst disk, which was an early design change that allowed retention of enough 
oxygen to provide one cabin repressurization following a burst-disk rupture. The re- 
seating burst disk provided a significant degree of safety for the crew if a burst disk 
ruptured during a lunar EVA period. This assembly is shown in the normal sealed 
mode (fig. 25(a)) and in a flow mode with the disk ruptured (fig. 25(b)). The Belleville 
washers would reseat the disk- support poppet when the upstream pressure was reduced. 



Figure 25. - Burst-disk relief assembly. 


Water Management Section 

Iodine compatibility. - All the water used in the LM is loaded before launch, and 
medical requirements exist for maintaining the water free of viable organisms for 
health reasons. This requirement evolved because there is an interconnection between 
the potable (drinking and food preparation) water and the reclaimed (from respiration 
and perspiration) metabolic water. (Notwithstanding the foregoing, it is considered 
likely that a biocide would be required even if there were no interconnection because of 
uncertainties in long-term water storage and the necessity of maintaining an acceptable 
microbiological condition. ) 

Tests at the main subcontractor facility showed that the sublimators could not 
perform using chlorine (introduced as sodium hypochlorite). In a hard vacuum, a 
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greenish residue (identified as chlorine hydrate) slowly formed on the ice layer. After 
a period of time, the increased concentration of the chlorine hydrate lowered the melt- 
ing point of the ice below 32° F. This melted the ice and caused water to run freely 
through the porous plates and to freeze in the vacuum space. 

Iodine was next tried as a biocide and found to be compatible with the sublimation 
process. Development testing of other portions of the water system and with metallic 
and nonmetallic materials showed generally good stability and only slight corrosion 
from the use of iodine. Corrosion which results with iodine concentrations of about 
15 ppm is essentially the same as that which occurs with water alone. 


Tests were performed to show that a proper iodine concentration could be main- 
tained for approximately 30 days. The medical requirement was that at least a 0. 5-ppm 
iodine residual had to be present when the last water was consumed, which could be ap- 
proximately 30 days after tank servicing. No onboard test devices were planned be- 
cause of the rather cumbersome checking techniques required of the crew. Further 
ground-test results began to show wide variations in iodine depletion rates. The vari- 
ables involved seemed to be inseparable, and the data were reviewed carefully several 
times before a pattern apparently emerged. The final conclusion was that the initial 
exposure of the water tanks to iodine resulted in an acceptably slow depletion rate, but 
that repeated exposures caused progres- 
sively faster depletion rates. The cor- 
rective measure was to avoid loading 


water containing iodine except for the 
flight load. The descent water tank con- 
figuration is illustrated in figure 26. The 
ascent tank is similar but is more spher- 
ical in shape. 

The mechanism of iodine depletion 
was found to be the diffusion of iodine va- 
por from the water, through the silicone 
rubber bladder, and into the surrounding 
nitrogen gas space. Water vapor also 
permeates the bladder, as does the nitro- 
gen pressurant gas. The humid iodine 
vapor attacks the anodized aluminum tank 
wall; and, as the anodized coating is 
corroded, more 6061- T6 aluminum is ex- 
posed. The exposed aluminum readily 
reacts with the iodine. As the iodine is 
depleted, the vapor pressure is reduced 
and more iodine vapor permeates the 
bladder to maintain an equilibrium vapor 
pressure, thus depleting the iodine in the 
water. The anodized aluminum standpipe 
that is immersed in the liquid side is con- 
sistently uncorroded, but the tank walls 



Water fill and outlet port 


show definite corrosion with the amount Figure 26. - Descent water tank 


dependent upon exposure time. 


(item LSC-330-404). 
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Exposure history was not readily apparent as the cause of iodine depletion, be- 
cause of the many variables of testing. Tank shells and tank bladders were often shifted 
from test to test (because not many test items were available for use) and reexposed. 
Exposure times and concentrations of iodine varied considerably. It was felt for a time 
that the bladder material reacted with the iodine, and "seasoning" of bladders was tried 
at several hundred ppm. Bladders which had been exposed to ethyl alcohol appeared for 
a time to cause fast iodine depletion. Until that time, the iodine was introduced in tinc- 
ture form (iodine in ethyl alcohol) because the ease of dissolving iodine in alcohol made 
the testing more convenient. Testing was changed to use water solutions of iodine only. 
Only after the tank shell exposure histories were carefully arranged in order did the 
depletion test results appear consistent. 

The water tanks on the LM-3 (Apollo 9) vehicle had been exposed to iodine in the 
altitude- chamber testing at KSC; thus, early depletion of the iodine was predicted. A 
bacteria filter was affixed to the water dispenser for that flight. The filter was not used 
on the LM-4 vehicle because the water tanks were not exposed to iodine before the flight 
water was loaded. 

Tank b ladder adhesions. - Silicone rubber bladders were used in the water tanks 
for zero-gravity expulsion. It was found that a bladder, when maintained in a collapsed 
state for a considerable period, would adhere to itself (adjacent folds, for example); 
and, when subsequently expanded, it would be weakened or damaged. This adhesion was 
of the nature of a fusion of the rubber. To prevent adhesions, the bladders were sub- 
sequently maintained in an expanded state by the application of several psi of dry nitro- 
gen pressure on the waterside. Whenever the bladder configuration was changed 
(inflations or deflations), a record was entered in a "Limited Life Log" in accordance 
with established program requirements. Pressure cycles on the tank itself were like- 
wise recorded for a comparison to allowable life cycles. The life limitations were 
based upon previous test experience and engineering judgments. 

During checkout operations at KSC, a bladder tear was discovered on the LM-7 
vehicle. The subsequent investigation failed to identify the specific cause of the failure, 
which could not be traced to a material defect or to improper pressure application or 
other handling problems. To ensure that flight tanks did not have tears, an X-ray ex- 
amination was implemented after the water was loaded for flight. Gas leakage checks 
had routinely been used to show that no tear existed just prior to waterloading. 

This is an example of the "explained" category of failure reports. No fault could 
be found with the bladder design or with the manner in which it was used. Special tests 
were implemented, however, to verify that the flight units were free of defects after 
completion of prelaunch preparations. 

Redundant water regulator and particulate contamination. - Particulate contamina- 
tion and corrosion were experienced a number of times during development and check- 
out. In general, the corrective measures were to progressively reduce the exposures 
to water and to dry the system more thoroughly following use. Even minor corrosion 
results in the generation of large amounts of particulate contamination. Significant 
water system corrosion was found in the first several LM vehicles, including the LTA-8. 
The corrosion occurred in the tubing interior, where the alodine coating had been de- 
stroyed when the gamah fittings (tube connectors) were swaged in place. Chromic acid 
flushes to replace the coating followed by water flushes to clean the system were 
required. 
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During checkout of the LM-4 vehicle at KSC, a water pressure regulator mal- 
functioned; and corrosion of some of the internal parts was apparent. During the in- 
vestigation of the problem, the sensitivity of the regulator design to particulates was 
a. major finding. Several bench test series were run with water which was intentionally 
contaminated. The tests imposed difficult conditions by varying system parameters 
and by running for long durations. The general findings were that, even though analysis 
showed that the design was sensitive to malfunctions caused by particulates, the units 
functioned satisfactorily in test. Two regulators in series apparently provided sufficient 
redundancy that additional protection (waterline filters) could not be justified. The pri- 
mary water system already contained two regulators in series, but the backup system 
had only a single regulator. A redundant regulator in the backup system was added at 
that time, effective on the LM-5 and subsequent vehicles. This was a field modification 
kit added downstream of the LSC-330-490 water control module. The redundant regula- 
tor (designated LSC- 330-433) had interior working parts identical to the existing 
LSC-330-415 regulators. A schematic view of the regulator is shown in figure 27. 

Water pressure regulators that would 
meet the tight specification performance 
requirements were difficult to manufacture 
and assemble. The large counterbalanced 
diaphragm assembly would sometimes be- 
come misalined, and disassembly and hand 
matching of parts was the practice. Once 
a unit had passed acceptance testing (in- 
dicating that all specifications were met), 
the subsequent performance was good. 

Flight performance was without flaw. 


Corrosion in the WMS, which resulted 
in particulate contamination, was not so 
severe that structural integrity was threat- 
ened. Only light, surface-type corrosion 
was found; however, this was significant 
from a particulate contamination standpoint. 

Extensive testing was performed to 
demonstrate the effects of iodinated water 
upon material stability in the WMS. These 
tests basically showed that the use of iodine 
in the concentrations required for water 
sterility purposes was no more detrimental than the use of water itself. Metallic and 
nonmetallic materials were tested, including dissimilar coupled samples; and the 
materials showed good overall resistance to corrosion. 

Bac teri a f ilter . - A requirement that no viable organisms be deposited on the 
moon as a result of systems operation was placed upon the LM ECS. The crewman 
condensate enters the sublimator water feedline and is eventually vented overboard as 
low-pressure steam. Micro-organisms contained within this line will not necessarily 
be killed by the vacuum nor filtered out by the sublimator porous plates. Furthermore, 
the contact time of the condensate and the iodinated stored water would not guarantee a 
bacteria "kill," particularly of spore-type micro-organisms. 


Reference 
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Figure 27. - Water pressure regulator — 
functional schematic. 
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A small-pore (0. 22 micron absolute) filter was developed for the waterline to 
retain the bacteria mechanically. The unit was to be placed in location A as illustrated 
in figure 28. Placement in location B was also possible but would require twice as 
many filters for the redundant water separators. 

Problems with gas blockage, which 
increased the pressure drop and effectively 
blocked the fine filter, were encountered. 

The gas in the water came from the water- 
supply tank, which became saturated with 
nitrogen at approximately 48 psia shortly 
after filling. The water pressure regulator 
settings could not be increased to force 
more water through the filter because of 
the limitations imposed by the sublimator 
and by the water separators. Additional 
pumping head requirements on the water 
separators would increase the suit-circuit 
gas pressure drop and thereby require 
revision to the suit fans. High water- 
supply pressure would cause sublimator 
breakthrough. 

The Interagency Committee on Back 
Contamination (ICBC) reviewed the status 
of the developments and recommended relaxing the requirement concerning bacterial 
deposits from this source. A bacterial filter was used on the LM cabin dump valve for 
the Apollo 11 mission. The requirement for this filter was deleted for later missions, 
and the cabin gas was dumped directly overboard at the times of lunar exploration. 

Compliance with the ICBC requirements was difficult (if not impossible) with the 
existing hardware. Later developments could have been pursued to possibly provide a 
hydrophobic/hydrophilic filter for water filtering. Also, if the ICBC requirements had 
been imposed early in the development, they probably could have been accommodated 
within the basic design. 

Gas solubility. - Although gas is mixed with the water, it has not been a problem 
in LM usage. On the LM-4 (Apollo 10) vehicle, there was a crew comment concerning 
the gas that they encountered in the drinking water; but it was not regarded as a prob- 
lem. Gas has caused no problems in water pressure regulation or in sublimator 
operation. 

The gas, which is nitrogen, enters the water by permeating the tank bladders 
following servicing. The water is not deaerated before loading because the nitrogen 
will saturate it anyway after loading. The water is probably saturated with air at one 
atmosphere in the ground servicing equipment. The only concern about gas saturation 
occurred after tank loading the first few times because the water quantity measurement 
device (WQMD) is basically a pressure transducer. As permeation takes place, the 
pressure of the sealed-off gas supply slowly decreases, causing a decrease in the 
WQMD reading and falsely indicating a slow water (or gas) leak. The rate of decrease 
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Figure 28. - Water bacteria filter 
locations. 
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and the level- off point, based on previous test observations and theoretical gas satura- 
tion data, have been furnished to flight controllers. Pressure decay rates greater 
than those predicted indicate a leak, while rates less than predicted indicate the perme- 
ation phenomenon rather than leakage. 

Orifice problems. - The water pressure regulators were set to control their outlet 
pressure from 0. 5 to 1. 0 psi greater than suit-circuit pressure. This was necessai'y 
to provide the water pressure required for sublimator operation. The pressure- sense 
lines, which provided the reference pressure, contained small orifices at the suit- 
circuit end. These orifices were provided originally to preclude loss of suit-circuit 
pressure if a sense line should break. 

During altitude-chamber manned testing at KSC on the LM-3 vehicle, it was noted 
that the water separators were performing poorly. Eventually, the carbon dioxide in- 
dications became high; and there were crew complaints of being warm and humid. The 
high carbon dioxide indications resulted from water being forced into the sensor because 
of the location of the sensor tubes. It was subsequently determined that the orifice in 
the water regulator sense line was plugged; and some unknown pressure was trapped in 
the sense line, causing an artificially high reference pressure. This caused the sub- 
limator supply pressure to be abnormally high, which required the water separators 
to pump against a high head pressure. Under these conditions, little or no condensate 
would be pumped out of the suit circuit. The factory checkout method verified all func- 
tions of the sense line except whether it was actually open to the suit circuit. With the 
unit in place, these orifices and protective screens were carefully removed to avoid 
particulate contamination in the suit circuit on the LM-3 vehicle and on all subsequent 
vehicles. The decision to remove the orifices was based on the extraordinary high 
reliability of the system plumbing. 

The failure to detect the blocked orifices at the factory resulted from checkout 
limitations that were imposed by certain aspects of the spacecraft system design. For 
example, the main checkout restriction imposed by the design was caused by the suit 
fans, which could accept full bus voltage only at operational (reduced) pressures. At 
sea level pressure, the fan voltage had to be dropped to 15 volts by ground- support 
equipment to avoid overheating the fan motors. Actual testing involving the suit circuit 
was thus restricted to KSC, where the manned altitude-chamber test was run. It was 
always desired to detect all faults at the factory before shipment of the vehicle. The 
factory checkouts were made as complete as possible, but sometimes they left some 
small portion of the system incompletely tested until later. 

A similar restriction on checkout, because of design, was the absolute pressure 
regulation of some devices. This deferred end-to-end pressure regulation tests to 
KSC, where subatmospheric pressures were finally encountered. If all pressure con- 
trol could have been gage-type or differential- type control, the checkout job could have 
been more thoroughly performed at the factory. 
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CERTIFICATION TESTING PROGRAM 


General Scope 

The ECS design concept of modularized subassemblies led to an early decision 
to perform certification testing at the module level for examining and verifying all 
possible component interactions during dynamic testing. Because it had been stipulated 
that any field failure of a single component would require replacement of the complete 
module or lowest replaceable element, it is reasonable to assume that certification 
should be performed at the same vehicle replacement level of assembly. 

Feasibility testing. - Design feasibility tests were conducted at the component and 
subsystem (module) levels. The component level tests were primarily used to verify 
design and to establish performance curves, and the subsystem (module) level tests 
were performed to identify component interaction and to verify that system design per- 
formance requirements were met. The hardware used was virtually production grade 
and was made from controlled procedures and drawings. 

Design verification testing. - Because production-type hardware was used during 
feasibility testing and very little redesign was required following feasibility tests, the 
design verification test requirement was deleted. 

Formal qualification. - Two sets of flight hardware were subjected to logic-group 
(module) testing. One set of hardware was tested to design limit certification levels 
consisting of mission- design- extreme environments, and one set was subjected to two 
normal mission- level environment tests plus ground environment tests. 

Design changes resulting from component failures during initial certification 
testing, plus component additions and redesign imposed by changes in system require- 
ments, were responsible for incorporating a delta qualification program following the 
initial logic-group qualification program. The delta qualification of new and modified 
hardware assured a more realistic certification by using the original modules as test 
beds (or fixtures) during testing. 

Man- rating. - To certify the life support section of the ECS, a complete test 
facility was built at the prime contractor site. The man-rating test facility consisted 
of a vacuum chamber, a vacuum system, a data system, and a life support section of 
the LM ECS, which was installed in the simulated LM cabin of the vacuum chamber. 

The facility was designated the LM Internal Environment Simulator (IES). 

Using the IES, the ECS man- rating was accomplished in two steps. The first 
step (phase I) used some preproduction hardware which differed from production hard- 
ware only in physical layout. The second step (phase II) used production hardware 
which was modified to provide instrumentation points necessary for gathering para- 
metric data. Although no design changes or modifications were identified during these 
tests, valuable crew familiarization and confidence were attained. Following these 
tests, the test chamber was moved to the NASA Manned Spacecraft Center, where it 
was used for further evaluations and provided some flight crew familiarization. 

Therma l- vacuum tests. - To ensure compatibility between all subsystems during 
vehicle exposure to expected environments, the LTA-8 vehicle was built and installed 
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in a special thermal-vacuum chamber, in which six manned tests were run at design- 
extreme metabolic and thermal loads to verify flight worthiness. 

Feasibility Testing and Design Verification Testing 

The original concept for hardware development was to conduct feasibility testing 
on preproduction hardware for the purpose of component and part selection, perform- 
ance evaluation, and design concept verification. These tests — which included per- 
formance, fluid compatibility, endurance, and thermal exposure — were conducted on 
the component, logic-group, and system levels of hardware buildup. Satisfactory 
completion of feasibility testing released hardware for production. Design verification 
testing would then be conducted with production hardware. As the hardware develop- 
ment phase progressed, the preproduction hardware had the appearance of production 
hardware; that is, very few T, hogouts Tt or heavyweight items were made for feasibility 
purposes. Therefore, critical portions of the design verification testing were included 
in the design feasibility program. 

No definite limit was set on quantities of hardware required to undergo feasibility 
testing. At least three of each item went through component, logic-group, and system 
level feasibility testing. 

Several hardware redesigns were required to meet feasibility test requirements. 
The following paragraphs indicate the type of redesigns required to meet specific test 
requirements. 

Performance. - The water separator (LSC- 330- 109) had excessive water carry- 
over. The pitot tube was redesigned to prevent splashing. Nine stator vanes were 
blocked to increase the velocity of the suit gas through the separator for increasing the 
starting torque. 

The primary sublimator (LSC-330-209) could not meet the required thermal per- 
formance. The manufacturing process of brazing the fins to the porous plate was 
changed to welding to increase the sublimation area. Control of the installation of 
porous plates was required so that the finer pore orientation was always uniformly in 
the same direction. The suit fan (LSC- 330- 118) rotor profile was changed, and the 
motor efficiency was increased to meet performance requirements. 

Structural. - The water/glycol accumulator (LSC-330-210) pressure curve was 
nonlinear. A spring guide was added to prevent the spring from dragging. The LiOH 
canister cover (LSC-370-127) was redesigned to meet torque requirements. 

Leakage. - The water check valve (LSC-330-401/492) seating arrangement was 
changed from a spring-loaded poppet to a flapper- type poppet, the oxygen shutoff valve 
(LSC-330-304) seat was changed to an aluminum hard seat, and the poppet material was 
changed to Kel-F to meet leakage requirements. 

Stability. - The cabin dump valve (LSC-330-307) main poppet spring preload was 
increased to meet vibration requirements. (See fig. 24. ) 
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Endurance . - The suit fan (LSC-330-118) motor bearing grease was changed to 
Andok-C, and the percent of grease fill was reduced to meet endurance requirements. 
The cabin fan (LSC-330- 102) motor bearing grease deteriorated and was changed to 
G-26 lubricant. 


Qualification Testing 

Design limit testing . - Design limit testing was performed to verify the functional 
capability of ECS components during or following subjection to environmental loads 
approaching the ultimate levels for which the equipment was designed. One complete 
set of production flight hardware was subjected to the following environments. 

1. Humidity and temperature (combined) 

2. Salt atmosphere (noncabin hardware) 

3. Sand and dust 

4. Vibration 

5. Acceleration 

6. Thermal vacuum 

7. Shock 

8. EMI (as applicable) 

9. Burst pressure (as applicable) 

Most hardware failures that occurred during testing were caused by improper 
test setups (i. e. , incorrect polarity at the test equipment/test item electrical interface 
and excessive test item leakage rates as a result of contamination introduced from test 
instrumentation, test area environments, and test fluid/gas supply sources) and im- 
proper manufacturing procedures, all of which could have caused component failure 
during normal operation, even without the design limit test environments. Hardware 
failures that were attributable to the actual test environments and that require sub- 
sequent redesign were few. The following paragraphs indicate — by test environment — 
the failed components, the fixture mode, and the redesign necessary to successfully 
complete qualification. 

Electromagnetic interference: Some cases of radiated and conducted EMI which 
occurred during this test resulted in adding suppression to some electrical components 
and in modifying test requirements for those which bordered on test limitations. The 
out-of-specification conditions in many cases involved switching circuitry and not the 
components directly, so no failed hardware listing is made. 

Vibration (lunar ascent/descent and earth-launch loads): The cabin pressure 
switch (LSC-330- 323) failure modes were out of specification, and contact chatter was 
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of sufficient duration to cause activation of hardware in the circuit. Redesign of this 
unit included shock mounting and slight changes to the specification pressure bands for 
activation and deactivation. 

Functional (operational, cycles): The water check valve (LSC-330-401/492) 
failure mode was excessive reverse leakage caused by contamination of the check valve 
seat. Redesign incorporated a much softer flapper-type seat which had a greater sur- 
face area and less susceptibility to contamination. 

The suit-circuit diverter valve (LSC-330-112) failure mode was an increase in 
handle torque beyond the specification limits and was caused by burring of the valve- 
shaft sleeve. Redesign resulted in replacement of the sleeve with one made from a 
higher Rockwell number (hardness) material. 

Subsequent to design limit qualification completion, many hardware design changes 
were incorporated to increase reliability and to delete flammable materials. Where 
applicable, delta qualification testing was performed to ensure that hardware operation 
was not affected. 

Endurance qualification testing . - The endurance qualification testing, which con- 
sisted of two mission simulations plus ground checkout time, was performed to verify 
the functional capability of ECS components during or following subjection to normal 
environmental loads. One complete set of production flight hardware was subjected to 
the following environments. 

1. Integration and checkout (cycles, operation) 

2. Vibration and temperature 

3. Thermal and vacuum 

4. Corrosive contaminants 

5. Oxygen atmosphere (oxygen, temperature, humidity) 

6. Shock 

7. Acceleration 

The failures that occurred during this certification test were (for the greatest 
part) characteristic of long-term operation, test rig induced contamination, and im- 
proper manufacturing procedures. As in design limit qualification, the failures that 
were directly attributable to the certification environment loads were few. The follow- 
ing paragraphs indicate by test environment the failed component, the failure mode, and 
the redesign necessary to complete endurance qualification successfully. 

Vibration (lunar ascent/descent and earth-launch loads): The cabin relief valve 
(LSC-330-307) had excessive leakage, which was attributed to contamination. Disas- 
sembly revealed that the foam material used as a volume filler had cracked. Redesign 
resulted in replacement of the foam material with molded silicone rubber. 
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Integration and checkout (endurance qualification): The water check valve 

(LSC-330-401/492) failure mode was identical to the failure which occurred during 
design limit testing. The redesigned unit used to complete design limit qualification 
was also used in the retest for this qualification. 

The suit-circuit diverter valve (LSC-330-112) failed to return to the egress posi- 
tion during electrical actuation. The failure was identified as a jammed detent ball 
between detent and shaft. Redesign resulted in a modification of the shaft detent cavity. 

The secondary glycol-loop sublimator (LSC-330-224) failed to meet performance 
criteria after 100 hours of operation. The failure was attributed to excessive braze 
flowing, incorrect porous-plate orientation, and particulate contamination. Redesign 
of the sublimator involved installing the porous plate by welding instead of brazing, 
modifying manufacturing procedures, and using MSC-approved water. 

Subsequent to endurance qualification, many hardware design changes were in- 
corporated to increase reliability and to eliminate flammable materials. Where appli- 
cable, delta qualification was performed to ensure that hardware operation had not been 
affected. 


Integrated Subsystems and Vehicle Testing 

Inte rnal environment simulator. - The IES test program was generated to man- 
rate the LM ECS prior to man-rating at the vehicle level. The test facility consisted of 
a vacuum chamber, a cabin volume pressure shell, all ECS components which were 
required for life support, and cabin wall temperature control to simulate mission 
thermal loads. 

The IES test program comprised four tests: one unmanned, one contractor 
manned, and two manned by MSC astronauts. The following summary covers test 
objectives of each test. 

Test 1 (unmanned): Test 1 was designed to provide assurance of specification 

performance of the ECS when exposed to design environments. Minor problems associ- 
ated with the metabolic simulator caused deviations from test procedures, but adequate 
data were compiled to enable proceeding to manned testing. 

Test 2 (manned — contractor pilot): Test 2 was designed to man-rate the ECS 
and to provide confidence for continued manned testing. The contractor pilot provided 
sufficient subjective comments before, during, and after the test to "debug” the test 
procedures adequately and to identify possible hazards to man. This test was highly 
successful, and only minor procedure changes were made prior to the next test. 

Tests 3 and 4 (manned — MSC astronauts): Tests 3 and 4 were identical to 
test 2, and the only anomaly which occurred was in a negative suit-pressure relief 
valve (special ground-test item). During cabin depressurization, the suit circuit was 
noted to be following the cabin pressure. After recycling the cabin pressure, this 
ground-test valve sealed off properly; and no recurrence of this anomaly occurred. 
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The only performance characteristic worthy of note was a temperature rise 
between a point directly upstream of the suit- isolation valve and the suit inlet. This 
temperature rise (approximately 9° F) was apparently caused by conduction across 
the isolation valve (a single two-port valve which controls the "cold” flow into the suit 
and the "hot" return flow from the suit) and between the suit supply and return umbil- 
ical hoses. Even though this heat loss was not predicted, the suit inlet temperature 
was below specification level; and no redesign was required. With the exception of 
the aforementioned minor anomalies, the IES test program was satisfactory. 

Sp ecial testing . - The liquid test rig (LTR) was a geometrical reproduction of the 
lunar module environmental control subsystem HTS and WMS and was designed to pro- 
vide a means for testing various configurations to determine heat-transfer character- 
istics and flow distributions for various cold-plate heat loads and flow conditions. This 
program was conducted in two distinct configurations, one being the LM- 1 vehicle sys- 
tem (a flight development vehicle which had additional cold-plated equipment and an 
automated water system for unmanned flight) and the other being a LM-4 vehicle system 
(a lightweight lunar landing vehicle with all development equipment removed). 

The flow balance phases of LTR testing were satisfactorily completed for both the 
LM-1 vehicle and LM-4 vehicle configurations. The only noteworthy test discrepancy 
was during the special test described in the following paragraph. 

A special test was conducted to verify the capability of the water/glycol ground- 
support equipment to adequately remove particulate contamination from the water/ 
glycol to below specification levels before and after vehicle servicing. Review of the 
test report showed that water/glycol samples were taken prior to LTR servicing; but, 
because of inadequate quantities of water/glycol after system servicing, no samples 
were taken. At test completion, the water/glycol was drained from the LTR and re- 
ported to be qualitatively "very dirty." 

The successful flight operation of the HTS and the WMS would tend to indicate 
that the LTR program was highly successful, but one major vehicle anomaly that oc- 
curred during subsequent ground testing indicated an area of inadequate certification. 
This vehicle problem, which should have been identified during the LTR testing, was 
the breakthrough of the secondary loop sublimators of the LTA-8 vehicle. (See previous 
discussion under "Sublimator breakthrough problems.") 

Lunar modu le test article . - The following paragraphs describe tests performed 
on the lunar module test article. 

Thermal vacuum: To verify design requirements for the Apollo lunar module be- 
fore manned flight, a special lunar module test article, designated LTA-8, was built 
and installed in a space simulation vacuum chamber. Because the LM program called 
for orbital flights prior to a lunar landing, the LTA-8 test program also was set up in 
two phases. Each test program was designed to provide environments and time lines 
simulating expected mission loads. Although the following summaries for each test 
phase show that few hardware problems were encountered during manned testing, those 
which did occur more than justify the importance of manned-integrated systems testing. 

The LTA-8/LM-3 configuration (manned earth-orbital simulation — cold case): 
The LM test article was installed in the space simulation chamber, and the thermal 
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environments were stabilized for the cold extreme of expected temperatures. The ECS 
anomalies which occurred during the cold test were for the most part connected with 
special ground -test hardware, procedure errors, and instrumentation anomalies. 
Descriptions of two significant failures follow. 

The water separator (LSC-330- 109) failed to start (during the second manning 
phase) until the third attempt. It was concluded that residual water from the previous 
manning phase was causing excessive friction which counteracted the low (gas flow) 
torque, thereby preventing a startup of the water separator. This problem had been 
identified during component testing; and a redesigned water separator, which develops 
more starting torque from the same gas flow, was certified for use in flight vehicles. 

The carbon dioxide sensor (LSC-330- 150) was indicating carbon dioxide partial 
pressures greater than 30 mm Hg during the second manning phase. Postflight analysis 
indicated that the sensor had failed because of environment incompatibility. Subsequent 
sensors for flight use were redesigned to reduce sensor susceptibility to moisture, to 
vibration, and to known circuit problems. 

The LTA-8/LM-3 configuration (manned earth-orbital simulation — hot case): 

The space simulation chamber was stabilized for the hot extreme of expected flight 
temperatures. As in the cold test, most failures or anomalies were in special ground- 
test hardware and instrumentation. One significant failure, which justified major sys- 
tem redesign, is summarized in the following paragraph. 

The secondary water/glycol loop (a backup life support and black-box cooling 
system) was designed to use the potable water system as an accumulator. Selection 
of the secondary loop punctured an isolation disk between the water system and the 
secondary glycol loop; and, at the same time, water was supplied to the secondary loop 
sublimators. During LTA-8 testing, the secondary loop glycol pressure was greater 
than the water system pressure at the time of secondary loop startup, causing the 
water/glycol mixture to enter the potable water system and to be supplied to the sec- 
ondary loop sublimators. Because a water/glycol mixture has a freezing temperature 
below that of water, no ice layer was formed on the sublimator plates and breakthrough 
occurred. 

As a result of the failure, the secondary glycol loop was redesigned, the potable 
water/glycol loop interface was removed, and a glycol accumulator (LSC-330-210) 
identical to the primary loop accumulator was installed. This configuration was certi- 
fied in the subsequent LTA-8/LM-5 tests. With the exception of the secondary glycol 
loop failure, all ECS test objectives were satisfactorily completed. 

The LTA-8/LM-5 configuration (manned lunar landing simulation): The LTA-8/' 
LM-5 thermal-vacuum tests were performed to verify that the LM-5 vehicle thermal 
design and thermal control system were adequate for worst- case (predicted) lunar land- 
ing environments. The ECS performed within predictions for both the hot and cold 
mission simulations. The only anomaly which occurred was an out-of-specification 
temperature for the cabin temperature control valve (LSC-330-203). Because a sub- 
sequent design change eliminated the cabin heat exchanger and temperature control 
valve, no discussion of the test anomaly is given. 
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The LTA-8/LM-3 and LTA-8/LM-5 thermal- vacuum tests satisfied the following 
test objectives: 

1. To demonstrate the capability of the vehicle environmental control system to 
provide a habitable environment in the cabin and pressure suit with the equipment op- 
erated in the earth- orbital and lunar landing mission- oriented thermal- vacuum 
environments 

2. To demonstrate the capability of the WMS to supply water to the boilers 
properly in quantities consistent with heat levels generated by the equipment operating 
in all modes consistent with representative earth-orbital and lunar landing mission- 
oriented thermal- vacuum environments 

3. To demonstrate the capability of the primary HTS to accept and to effectively 
dissipate the thermal loads generated by the electrical equipment and a crew when 
operated in modes consistent with earth-orbital and lunar landing mission-oriented 
thermal- vacuum environments 

4. To demonstrate that the cabin pressure-shell leak rate will not exceed 

0. 2 pound per hour (The leakage shall be measured before the first manning, when 
the crew is not in the cabin, with a cabin pressure of 4. 8 + 0. 2 psia and the vehicle 
operating in a representative earth- orbital and lunar landing mission- oriented thermal- 
vacuum environment. ) 

5. To demonstrate that, during unmanned and manned operations, the cabin 
atmosphere and suit loop contain no contaminants which would have an unacceptable 
physiological effect on the crew 

6. To demonstrate the capability of the secondary HTS to accept and effectively 
dissipate the heat generated by electrical equipment, mounted on redundant cold plates 
and cold rails, when operated in modes consistent with earth- orbital and lunar landing 
mission-oriented thermal- vacuum environments 

7. To show acceptable cabin depressurization operation under cold lunar con- 
ditions with the antibacteria filter installed on the cabin relief and dump valve (Cabin 
depressurization from 5. 0 psia to 0. 08 psia through the forward relief and dump valve 
shall not require more than 310 seconds. ) 

8. To show that the primary lithium hydroxide cartridge can be replaced while 
the cabin is depressurized and while the crew is supported by the vehicle environmental 
control systems 

9. To determine the cabin temperature gradient, with and without cabin fan 
operation, when crew activity is at a low level 


VEHICLE AND ACCEPTANCE TESTING 


Acceptance tests were conducted on all deliverable ECS components or assemblies 
to provide assurance that the equipment performance was within the limits of the design 
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parameters and that the equipment was free from material, construction, workmanship, 
and functional deficiencies. Prior to vehicle installation, most equipment received a 
preinstallation test to ensure that no damage had occurred during handling, shipment, 
or storage. 

The vehicle level of acceptance consisted primarily of tests conducted on equip- 
ment installed in the vehicle, from individual section level to "fullup" (complete) sys- 
tems test. A Customer Acceptance Readiness Review (CARR) was conducted on each 
vehicle for increased levels of testing. Phase I CARR was conducted after subsystem 
installation and served to identify constraints to subsystem testing. Phase II CARR was 
conducted prior to the start of Final Engineering Acceptance Tests (FEAT). Phase m 
CARR was conducted after FEAT to assess the readiness of vehicle acceptance and to 
obtain authorization to ship. 

The basic intent of acceptance testing was to "wring out" completely an item on 
a component level. Unique test functions were generally impractical on the vehicle 
level. These tests were performed on the component or module only and included such 
tests as vibration, thermal cycling, proof pressure of tanks, and indepth component 
performance. Test functions were repeated only when the previous test results were 
violated by a change in stimuli or by a different installation procedure. In general, 
test functions on a component were reduced as the component progressed to the next 
level of assembly. 


FLIGHT EXPERIENCE 


Lunar Module 1 (Apollo 5) 

The primary objectives for the LM-1 vehicle mission were to flight-verify the 
ascent and descent propulsion systems and the abort staging function. Because the 
vehicle was unmanned, only the ECS thermal control and its supporting functions were 
used during the mission. Life support hardware was included in the vehicle but was 
deactivated. 

The glycol temperatures remained within predicted values throughout the mission. 
No anomalies were observed during the mission; however, ascent water tank number 2 
instrumentation indicated a small leak prior to launch. No water leakage was detected, 
and a leak of the tank pressurant gas was suspected. The degree of leakage would not 
compromise the mission because water sufficient to complete the mission and pres- 
surant gas were known to be available. 


Lunar Module 3 (Apollo 9) 

The ECS was activated three times and operated normally during the 26 hours of 
manned operation. All ECS operating procedures required for the lunar mission were 
verified. All components functioned according to plan with the exception of a valve 
position indicator on the LM pilot suit flow control valve, which gave erratic indica- 
tions. This position indicator provides information for ground controllers and does not 
control any system operations. 
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The crew reported that the cabin noise was excessive during helmets- off opera- 
tion. The noise was caused primarily by operation of the cabin fans and the glycol 
pumps. The flight procedures were changed to limit cabin fan operation at the discre- 
tion of the crew, and a noise reduction survey was initiated for the glycol pumps. A 
design change was made, effective on later vehicles, to reduce pumping system noise. 


Lunar Module 4 (Apollo 10) 

The ECS was activated for approximately 12 hours and performed satisfactorily. 
Loss of cabin pressure during LM jettison provided an opportunity to evaluate the ECS 
under a rapid decompression failure. The automatic functions of the suit loop were 
verified when the suit loop locked up at 4.4 psia. Additionally, satisfactory perform- 
ance of the cabin pressure control logic was verified. This unplanned situation rep- 
resented a severe test of the ECS, and all ECS functions were nominal. 

The primary lithium hydroxide cartridge was returned to earth for analysis 
because of an indicated high rate of carbon dioxide increase, followed later by a de- 
crease. Chemical and X-ray diffraction analyses of the cartridge indicated no evidence 
of cartridge malfunction. It was concluded that the lithium hydroxide chemical con- 
version variations, combined with sensor tolerances, accounted for the flight 
performance. 

The crew reported that the drinking water contained gas. The nitrogen, used to 
pressurize the water system prior to launch, penetrates the tank bladder and slowly 
saturates the water at the fill pressure of 48 psia. As the absolute pressure is re- 
duced, the dissolved nitrogen is released. The water hose and connecting plumbing 
were not serviced with water, and this entrapped air initially added to the problem. 
Prelaunch procedures were changed to include servicing the water hose and connecting 
plumbing. 

The crew reported that the cabin was noisy, primarily because of the glycol 
pump. One cabin fan was used for approximately 30 minutes and was then turned off 
because it was not needed. The use of molded earpieces significantly attenuated the 
glycol pump noise. 


Lunar Module 5 (Apollo 11) 

The ECS satisfactorily supported all lunar operations with only minor exceptions. 
Depressurization of the cabin for the EVA required more time than predicted. The 
data indicate that the cabin pressure transducer was reading high at the low end of its 
range; consequently, the crew could have opened the hatch sooner if the true pressure 
had been known. Additionally, the requirement to use the bacteria filter which snaps 
onto the cabin dump valve was deleted for future missions. It was known that this 
filter slows down the gas flow, thus extending the cabin dump time slightly. 

The carbon dioxide sensor output became erratic after lunar ascent. The carbon 
dioxide sensor samples the suit-circuit supply gas from a vent line connected to the 
condensate drain tank that was used during lunar surface activities. It is probable that 
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some free condensate entered the sample line and was drawn into the carbon dioxide 
sensor. Any free water in the optics section of the sensor will disturb the IR signal 
and cause erratic performance. To preclude the introduction of water into the sensor 
from the drain tank, the vent line was relocated upstream of the suit fan on later 
vehicles. 

During the sleep period on the lunar surface, the crewmen reported that they 
were too cold to sleep. Analysis of the conditions experienced indicated that, once the 
crewmen were in a cold condition, there was not enough heat available in the ECS to 
return them to a comfortable condition. In addition to the required procedural changes 
which were designed to maintain heat in the suit circuit, hammocks were provided for 
subsequent missions to improve crew comfort and to reduce heat conduction from the 
crewmen. 


CONCLUDING REMARKS 


Several generalized conclusions can be made from the development experience of 
the lunar module environmental control subsystem. The development problems of the 
state-of-the-art advances received considerable attention, and these were successfully 
overcome. 

The discovery of a defect or an out-of-tolerance condition was followed by the 
determination of its cause. The most positive corrective action was then instituted to 
prevent recurrence, and this method of control proved to be successful. 

Most of the problems experienced were caused by some human, small error 
which resulted in an imperfection in a unit. The system of checks and rechecks was 
quite successful in uncovering defects during ground testing as evidenced by consider- 
able successes in flight. 


Manned Spacecraft Center 

National Aeronautics and Space Administration 
Houston, Texas, September 14, 1971 
914-50-80-10-72 
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